4 ms·

"uv run" seriously needs a sandbox. Running arbitrary code from arbitrary dependencies with 0 version locking provides no guarantees on what you are actually ru

"uv run" seriously needs a sandbox. Running arbitrary code from arbitrary dependencies with 0 version locking provides no guarantees on what you are actually running.

unglaublich 1y ago
You can by set dependencies explicitly in the script's header. https://docs.astral.sh/uv/guides/scripts/#declaring-script-dependencies https://docs.astral.sh/uv/guides/scripts/#declaring-script-d...
BiteCode_dev 1y ago
uv run is using virtual envs, that's the de facto standard, and those are sandboxes for python deps. So it already is. Plus inline deps mean you can pin python versions and 3rd party modules using pyproject.toml syntax in a comment of your script. This is not perfect locking, as it doesn't pin sub dependencies, but it's already more that any other tool out there. If you want perfect locking, create a project, and use uv lock. You are already in a different category of code.
- simonw 1y ago
  OP isn't talking about virtual environment style sandboxing, they're talking about sandboxes that prevent arbitrary code from deleting or stealing any information your user account has access to on your computer.
  - throwaway290 1y ago
    Run it in a Docker container?
    - cedws 1y ago
      Docker isn’t a sandbox and shouldn’t be treated like one. Admittedly if I’m going to run untrusted code I’ll run it in Docker, but I’m aware that whatever I’m running could break out. I wouldn’t blindly run some bullshit even in Docker unless I’m 90% sure it’s safe already.
      - throwaway290 1y ago
        How do you get to 90% sure for code that has any dependencies?
      - OutOfHere 1y ago
        Why is Docker (or extensions thereof) not a sandbox? Granted, it could access the internet, but that's necessary.
        cedws 1y ago
        Docker's primary purpose is to give applications their own namespaces in which they can run without conflict. It does confine applications to their own root filesystem, own process namespace and so on, but this isn't intended as a security boundary. cgroup escapes happen. Firecracker and gVisor provide much stronger isolation. Both are battle tested; clouds run millions of multi-tenant workloads on these every day. Docker would simply never even be a candidate for this purpose.
      - integralid 1y ago
        >but I’m aware that whatever I’m running could break out If you have a working docker escape exploit at hand, that works on unprivileged containers, you can earn some good money. Just saying. Docker was not created as a sandbox, but people rely on it for security and it is a sandbox at this point. Hell, containerd is one of kuberbetes backends and it absolutely relies on it being a secure sandbox.
  - BiteCode_dev 1y ago
    This has been attempted many times with python, and always been a failure because of the dynamism of the language, even by big actors. The solution, therefor, as always been to use the OS tooling for that. Even the .Net ecosystem eventually went into that direction. The JS ecosystem is making that mistake right now, and will of course, deprecate this API in 10 years after they realize they can't make it secure either unless they basically reimplement BSD jails entirely.
    - deleted 1y ago
      [deleted]
    - simonw 1y ago
      Deno has had this feature for five years already, since May 2020: https://deno.com/blog/v1 https://deno.com/blog/v1
simonw 1y ago
Implementing sandboxes is really hard... but Astral are demonstrable great at solving hard problems. I dream of them one day saying "we've solved sandboxing for Python scripts" ala Deno https://docs.deno.com/runtime/fundamentals/security/ https://docs.deno.com/runtime/fundamentals/security/
- indigodaddy 1y ago
  There’s lots of options not native to the tool. Just a few: devbox on MacOS. distrobox/toolbx on Linux. Project Bluefin has some really good ideas and concepts about all this: https://docs.projectbluefin.io/bluefin-dx/ https://docs.projectbluefin.io/bluefin-dx/
rjh29 1y ago
That's the job of docker or systemd-nspawn. It shouldn't be implemented by every single command.
- OutOfHere 1y ago
  devcontainer builds upon it to further the sandbox.
mvieira38 1y ago
Why is it their job to check for security? Sandboxing would make the ergonomics significantly worse for running quick scripts with uv run --script
- cipehr 1y ago
  I took gp’s comment to mean something more like deno. Deno is nice because you can explicitly allow/deny filesystem, network, etc. in an ergonomic way like `—-allow-fs` So not sure it would necessarily be ergonomically worse. It could even be a new run command `uv srun` or something…
  - indigodaddy 1y ago
    But uv isn’t a framework, isn’t that the difference, ie why they wouldn’t necessarily think it’s appropriate to delve into that particular territory?
- charcircuit 1y ago
  This is like asking why do web browsers need to sandbox javascript. Giving full permissions to untrusted code is an attacker's dream.
drewbitt 1y ago
I have seen several Pyodide in Deno implementations lately.
kortex 1y ago
It might be a cool thing for them to provide some kind of container metadata in the `# /// script` block so that e.g. it automatically runs the script in a container.
vs4vijay 1y ago
Maybe use along with "Pyodide"?

"uv run" seriously needs a sandbox. Running arbitrary code from arbitrary dependencies with 0 version locking provides no guarantees on what you are actually running.

unglaublich 1y ago

You can by set dependencies explicitly in the script's header. https://docs.astral.sh/uv/guides/scripts/#declaring-script-dependencies https://docs.astral.sh/uv/guides/scripts/#declaring-script-d...

BiteCode_dev 1y ago

uv run is using virtual envs, that's the de facto standard, and those are sandboxes for python deps. So it already is. Plus inline deps mean you can pin python versions and 3rd party modules using pyproject.toml syntax in a comment of your script. This is not perfect locking, as it doesn't pin sub dependencies, but it's already more that any other tool out there. If you want perfect locking, create a project, and use uv lock. You are already in a different category of code.

simonw 1y ago
OP isn't talking about virtual environment style sandboxing, they're talking about sandboxes that prevent arbitrary code from deleting or stealing any information your user account has access to on your computer.
- throwaway290 1y ago
  Run it in a Docker container?
  - cedws 1y ago
    Docker isn’t a sandbox and shouldn’t be treated like one. Admittedly if I’m going to run untrusted code I’ll run it in Docker, but I’m aware that whatever I’m running could break out. I wouldn’t blindly run some bullshit even in Docker unless I’m 90% sure it’s safe already.
    - throwaway290 1y ago
      How do you get to 90% sure for code that has any dependencies?
    - OutOfHere 1y ago
      Why is Docker (or extensions thereof) not a sandbox? Granted, it could access the internet, but that's necessary.
      - cedws 1y ago
        Docker's primary purpose is to give applications their own namespaces in which they can run without conflict. It does confine applications to their own root filesystem, own process namespace and so on, but this isn't intended as a security boundary. cgroup escapes happen. Firecracker and gVisor provide much stronger isolation. Both are battle tested; clouds run millions of multi-tenant workloads on these every day. Docker would simply never even be a candidate for this purpose.
    - integralid 1y ago
      >but I’m aware that whatever I’m running could break out If you have a working docker escape exploit at hand, that works on unprivileged containers, you can earn some good money. Just saying. Docker was not created as a sandbox, but people rely on it for security and it is a sandbox at this point. Hell, containerd is one of kuberbetes backends and it absolutely relies on it being a secure sandbox.
- BiteCode_dev 1y ago
  This has been attempted many times with python, and always been a failure because of the dynamism of the language, even by big actors. The solution, therefor, as always been to use the OS tooling for that. Even the .Net ecosystem eventually went into that direction. The JS ecosystem is making that mistake right now, and will of course, deprecate this API in 10 years after they realize they can't make it secure either unless they basically reimplement BSD jails entirely.
  - deleted 1y ago
    [deleted]
  - simonw 1y ago
    Deno has had this feature for five years already, since May 2020: https://deno.com/blog/v1 https://deno.com/blog/v1

simonw 1y ago

Implementing sandboxes is really hard... but Astral are demonstrable great at solving hard problems. I dream of them one day saying "we've solved sandboxing for Python scripts" ala Deno https://docs.deno.com/runtime/fundamentals/security/ https://docs.deno.com/runtime/fundamentals/security/

indigodaddy 1y ago
There’s lots of options not native to the tool. Just a few: devbox on MacOS. distrobox/toolbx on Linux. Project Bluefin has some really good ideas and concepts about all this: https://docs.projectbluefin.io/bluefin-dx/ https://docs.projectbluefin.io/bluefin-dx/

rjh29 1y ago

That's the job of docker or systemd-nspawn. It shouldn't be implemented by every single command.

OutOfHere 1y ago
devcontainer builds upon it to further the sandbox.

mvieira38 1y ago

Why is it their job to check for security? Sandboxing would make the ergonomics significantly worse for running quick scripts with uv run --script

cipehr 1y ago
I took gp’s comment to mean something more like deno. Deno is nice because you can explicitly allow/deny filesystem, network, etc. in an ergonomic way like `—-allow-fs` So not sure it would necessarily be ergonomically worse. It could even be a new run command `uv srun` or something…
- indigodaddy 1y ago
  But uv isn’t a framework, isn’t that the difference, ie why they wouldn’t necessarily think it’s appropriate to delve into that particular territory?
charcircuit 1y ago
This is like asking why do web browsers need to sandbox javascript. Giving full permissions to untrusted code is an attacker's dream.

drewbitt 1y ago

I have seen several Pyodide in Deno implementations lately.

kortex 1y ago

It might be a cool thing for them to provide some kind of container metadata in the `# /// script` block so that e.g. it automatically runs the script in a container.

vs4vijay 1y ago

Maybe use along with "Pyodide"?